aa1c5c127694e831e908a52a595c2c553d58088b206c83db14241ff8c109a442

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5253dfb2fb36f5996f781726b83b98c_JaffaCakes118.html
Size

27KB
MD5

d5253dfb2fb36f5996f781726b83b98c
SHA1

263baae692be49d98e6348cadafe3e9ad686ff3e
SHA256

aa1c5c127694e831e908a52a595c2c553d58088b206c83db14241ff8c109a442
SHA512

8c5fae90265c2be4e4b04802698847391a906bbb84e96d1982504d9d22280aa3fef5b6b08050bead3c398aa291c20fdb5a5cfef664c4fe12f5847d7bdf67eb64
SSDEEP

192:uwLkb5n9CnQjxn5Q/0nQiePNninQOkEntM+nQTbn1nQ9enjm6ufxrQl7MBvqnYne:UQ/ECFWxyS9WnB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33760E31-6E2C-11EF-BA16-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000993f27e69476fd01478f0fbb174f5bd5c8bdc916d05b2b5fe1d5798f15450fa7000000000e800000000200002000000057f4d06a2f365ebbd66263b3c8fe446d8edbb0922ead2640be5a30a0b74358869000000012bd13f76115855234a1e835b1bfc52c5a9c621bffb058a7802bc652640058a8f514007b91c849ead1b92c79315d1511390c716bc320a53e4430a2358d85299d47cc0931ab424efdd36e553df8b7e9bbfefc2734e08b3e585b2c30c8c5c550c3ea43e11d0b7cb728f00d4228eb9102b2f1d761589840d8727f207f1a142fa305a6c08c3f6a99e94d49b0833a1b177cd64000000016959a8a96f4912b8ddb2b0793b642b60fe381fac9bee83aba21dc7f711fe8585bc3d110b389b8ee942c186857790a4e878d7e7eb3cd8d3d54a451bc5ac7f318	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bab0093902db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431994028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000005457bee4329bc6b0e673f02a77866ebe084d1def5eeb2b83a50b3074b2bcd3a2000000000e8000000002000020000000a0540126ee419038d63472c6325dcbdf2f1e339636b477d271f5921ea835d84520000000839b1152ba735566e97d1d21c09272c325485c386c7fa6136fbed77e37d0e24140000000ea1fccc4261e2518cc51728180b1bfa42d2f66eaaced68c74e961c3c6cb38f4adb76e7f93399fbdcced96e32330e024300f66ecbe9e8618e09d27c2ecc618a56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
1796	IEXPLORE.EXE
1796	IEXPLORE.EXE
1796	IEXPLORE.EXE
1796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1796	2600	iexplore.exe	30
PID 2600 wrote to memory of 1796	2600	iexplore.exe	30
PID 2600 wrote to memory of 1796	2600	iexplore.exe	30
PID 2600 wrote to memory of 1796	2600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5253dfb2fb36f5996f781726b83b98c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
909ef10c94342dcfabef5eeec183ae86

SHA1
bedbc7b931397e5016d6c8e41ac4331d87263d21

SHA256
1b5f2069059eb13dd60ac968eacadb44234e505642a8354b2d07d0cc83ef2ad8

SHA512
d76662902b2595fef5d84a258075fd3e5699874668e720237caff676df23bc354c8d0782b79d7764b231889b72d8702e8bc5c66ca6ad78e4411e21dc2666fad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0274ea70cf332eb65626faf0c0594ba

SHA1
bd40b81ab5d47dbcc6e36f747dc4c2392034a4b3

SHA256
f4188fe4629ef09a33b02847a79adcbf3b34d10f7db8249040be7b71d8543756

SHA512
726046f002a9a2edab86c2785e51b48897c82aa4e25470f4b02b9348bf62f54e5e788093ea82f33b46443a13d8ac9abb8e82e2b40954400ab129ee22ed5fab6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6a2a141d108f1026c6eabd1f5264122

SHA1
614e67c5dc1fa1e17440bdbdf55cec387fa6b053

SHA256
2932257b0700f8c6fcc93a06d444bc8de4c39e45db2d94b4166adf861659628f

SHA512
6b006ade04cd50118cf8947c72bcad0eaebdc7906ab1e6290acde6376f1cad7ca237cb52e9a36c995e36879898984fc7232cb18fd4de7739f2f20ed3468ae066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fda03fc66233ef02a844c781b9faba12

SHA1
97352794388f6866d871c1de7b46980fe2ee8b1f

SHA256
9785b76e57d6828251be51e89573eee95a240980582b779aaac6e941a97ca7b4

SHA512
22e2ee9783799cbb9226b0bca815cba687f4f31be5c8a75574b43ac19c5613abc2199ffe2e426d05f187655522e653aece3f11c479d753de2cb0de1b4569935e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa5910ebdc08c6b062ab3421371a6dca

SHA1
212e19233a563d690bf61d4a9a7829e2b46d3f7c

SHA256
b4901ef42469c628e135cee545594d6ba8570cb0e439cd06fdea98bd012963af

SHA512
4377e873d2064aee5a61ce972d46276d4a895d808d7a4d0bdff80cb81d186f44d4be1591af63bae8ac201304bab899047afcb498195e59a2cd5472a73bf389d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a1b67674706fe8f84b7d90fe98b5456

SHA1
ae07de42099fafabe55b52d59fd68af92062c3e1

SHA256
1e176a068b30e84c3abacd697ea577807e489c0e5ae54dfbf69451b35f72289e

SHA512
01b7d44ccbd8068d15ee7497f7ba5ce6296d8edbc8aed504da4ef245027326ada77530d857833c3eacb793dfd691a50c94fbbc8b20e78cdec563848db5b42c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab765ccaa59d2a4526de0fee605d13f

SHA1
710fb7a5323c93f7298e10fa9e30076189f3c70c

SHA256
405ec4c076c2954d58ab35eee1bb6bc6a348e6d81b74415574023c817c3234f2

SHA512
0d959edff7fcb03f780e71a9e96a5d5a6d967c6287447054ca46fa6761bb1d51bd1ea55fdc61d9e46a9318ab64344f4a79f5ac54dd4325e4693f2181cd5e5131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec4cc3e268845b23bf79859a7fad12d6

SHA1
dc9b90b0d6cc79c9fd9211b503518c416809e617

SHA256
028668cc489519ed075578d034320b88ad026798b9cfeafb262ca06cb005a532

SHA512
06c5445622db158ad6a30e49db7add2fecfe27dd3b380da91e8492e7c8264235a024419927965ab5fc8279d5abb8cb8b2b66460dd93cefb1cc7d47f13dff4c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f20cd0bd70845628ed7eb0f710f793b

SHA1
69adcb770627f34616517ce5116e1a6ac5e3ae5e

SHA256
eb5b9ee151ee3215254c1e8e6ea6e630a9d6073efc7da992c611400f126bc99b

SHA512
7e199335fc532e61737088629850facd1b3f84843f52ac37d1298aee35d32c1f903e642d513c9f474fb3e4c0a2105ff5de736455822ea9704486dbbb20f4443a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
022db2ff08a83c88fae04259433b9295

SHA1
84e89a47651ab0ea49982f7c22927d6f74fac738

SHA256
359e8aa08c771ee612814c0559c4415c145ac3ef8aa166848420c370de4c26fa

SHA512
a0cf572f8c4ec5d9ba63086c7e6bea446ccaff8e2e20c0547efbf360d27f5e30fe36419074a907a7735e1c896934272d07a0cc7e8805ff6861d4c7f0aa86e1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f3c44c3c53959745b3a0f6477a53c5

SHA1
81a424db02a5dd8e9265abd46575c92bf05a7c87

SHA256
a2a22fadc2c1eff2ab2dd032a9ba701d0ff9555ef9ce33ccd045380709b133d1

SHA512
1199d08601b7d538446afd61a85bca007a08a93ddfe54c129b6e61579cc06482d4417b010fe645ba8194b95c4a71a9db22197595e41149d84baea532eba88237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea050ff93f5581a6817b04b7138293b

SHA1
e086a8d580618685688899a9f21d4f1e98f410d5

SHA256
a68de429f69102f8321b3dce5307adb769c3f64efcf32e181fcb452af0f08d64

SHA512
9568863070b348735c0b0bea58040024059e8b547d39718768a3cd1ee462022e14f964feff98c20233e8b7c27de802c99972a19c0fac6623af570d6e5866ddee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7068e676c13f6ab806125dec6b76312

SHA1
0a38020912144f938b3c103531a87f20164d604a

SHA256
ace20032792d83b6e15f55072627ece1b4852f5c4f910156bbb9c6c745d505d6

SHA512
a7a01d09b756c1bb1c6b8951ee990fa40b4a9606b6f383b21cc58e44e1c43b5865dc1090f4f9597bfcbabda50aa411d30770f1d20fba5aa7ec841cffdacc4a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c33f521a4319d4c67fd9e73ddb44e1d

SHA1
2ff8cb951885b9dcf8b659ed88e847dba47dc718

SHA256
3c39ff24c20a567d624f715ef36474139a31c623a7dbbadbf236beac68622b06

SHA512
d896f51c0498753d1e722ab513de54311a42f15bfce856724a11bac7921e61186799b0ee7154a904e484a3442f79da848170a465a6e796f28d61ae4588cef447

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC803.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit